Function maskDir

libcontainer/rootfs_linux.go:1325–1327

maskDir mounts a read-only tmpfs on top of the specified path.

(path, mountLabel string)

// maskDir mounts a read-only tmpfs on top of the specified path.
func maskDir(path, mountLabel string) error {
	return mount("tmpfs", path, "tmpfs", unix.MS_RDONLY, label.FormatMountLabel("nr_blocks=1,nr_inodes=1", mountLabel))
}

// maskPaths masks the top of the specified paths inside a container to avoid
// security issues from processes reading information from non-namespace aware